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Via Electronic Mail (idtheft@oag.state.md.us) 

Office of the Attorney General 
Attn: Security Breach Notification 
200 St. Paul Place 
Baltimore, Maryland 21202 

Re: Notification of Data Security Incident 

Our File No.: 1172265 


Dear Attorney General Brian E. Frosch: 

Our clients, Voelker & Associates, P.C., a law firm, and Three Rivers Settlement 
Services, Inc., a provider of commercial and residential real estate settlement services 
(collectively “Voelker Entities”), located in Allison Park, Pennsylvania, understand the 
importance of protection and personal information provided by its clients and is making this 
notification to your Office pursuant to Maryland Code Commercial Law § 14-3504. 

On November 13, 2018, one of the employees of the Voelker Entities received 
information from a third party that the third party was receiving emails that purported to be from 
an account associated with the Voelker Entities. The employee confirmed that this email was not 
sent from the Voelker Entities and informed the third party to disregard the email. Voelker 
Entities immediately requested that its IT consultant evaluate the Voelker Entities’ workspace 
and identify any signs of infection and/or unauthorized access to the network. The consultant 
immediately changed all passwords associated with the Voelker Entities’ servers and email 
accounts and undertook additional security measures to ensure the continued integrity of its 
systems. In an abundance of caution, Voelker Entities retained a forensic investigator to 
determine the nature of the compromise and identify any individuals whose personal information 
may have been compromised. 

The forensic investigation concluded that one (1) Office365 account associated with the 
Voelker Entities was compromised and therefore accessed. The investigation confirmed that the 
breach occurred on or about October 9, 2018 through approximately January 31, 2019. As a 
result, and in continuing to exhaust investigative efforts, the Voelker Entities undertook a full 
and time-consuming analysis of the impacted account. Specifically, the investigation identified 
the existence of personal information of individuals within this account, including information 
such as social security numbers, tax identification numbers, passport numbers, drivers’ license 
numbers, and health information. The forensic investigation and comprehensive data analysis of 
the account concluded on or about February 8, 2019. Please note that, at this time, no one has 
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reported to us that they have experienced loss, and to the best of our knowledge, no one has 
experienced any loss. 

Nonetheless, in an abundance of caution, Voelker Entities will be providing written 
notification on March 13, 2019 to 260 individuals, including one (1) Maryland resident pursuant 
to Maryland Code Commercial Law § 14-3504, indicating the above. A sample copy of the 
notification to the Maryland resident is attached. As noted in the attachment, Voelker Entities 
has included an offer to provide twenty-four moths of three-bureau credit monitoring services to 
the affected Maryland resident, as well as all of the 260 individuals notified as a result of this 
incident. 

Voelker Entities are continuing to work closely with leading security experts to identify 
and implement measures to further strengthen the security of their system(s) and to help prevent 
this from happening in the future. 


Best regards, 

GORDON REES SCULLY MANSUKHANI, LLP 

/i./ 7 TfiLtut. TfthdcLicJffKrxrft 

Brian E. Middlebrook, Esq. 


Enclosures 



Voelker & Associates, P.C. 

Attorneys at Law 
Return Mail Processing Center 
P.O. Box 6336 

Portland, Oregon 97228-6336 


Three Rivers Settlement 
Services, Inc. 

Return Mail Processing Center 

P.O. Box 6336 

Portland, Oregon 97228-6336 
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«name_addr_l» 

«name_addr_2» «name_addr_3» 
«name_addr_4» «name_addr_5» 
«city», «state» «zip_5» «zip_4» 
«country» 


March 13, 2019 


Dear «Name_Addr_l»: 


Voelker & Associates, P.C. and Three Rivers Settlement Services, Inc. (collectively “Voelker Entities”) value 
your business and understand the importance of protecting your personal information. We are writing to inform you that 
we recently identified and addressed a security incident that may have involved your personal information. This notice 
describes the incident, outlines the measures we have taken in response, and advises you on steps you can take to further 
protect your information. 

What Happened? 

On November 13, 2018, one of the employees of the Voelker Entities received information from a third party that 
the third party was receiving emails that purported to be from an account associated with the Voelker Entities. The 
employee confirmed that this email was not sent from the Voelker Entities and informed the third party to disregard the 
email. Voelker Entities immediately requested that its IT consultant evaluate the Voelker Entities’ workspace and identify 
any signs of infection and/or unauthorized access to the network. The consultant immediately changed all passwords 
associated with the Voelker Entities’ servers and email accounts and undertook additional security measures to ensure the 
continued integrity of its systems. In an abundance of caution, Voelker Entities retained a forensic investigator to 
determine the nature of the compromise and identify any individuals whose personal information may have been 
compromised. 

What Information Was Involved? 

The forensic investigation concluded that one (1) Office365 account associated with the Voelker Entities was 
compromised and therefore accessed. The investigation confirmed that the breach occurred on or about October 9, 2018 
through approximately January 31, 2019. As a result, and in continuing to exhaust investigative efforts, the Voelker 
Entities undertook a full and time-consuming analysis of the impacted account. Specifically, the investigation identified 
the existence of personal information of individuals within this account, including information such as social security 
numbers, tax identification numbers, passport numbers, drivers’ license numbers, and health information. The forensic 
investigation and comprehensive data analysis of the account concluded on or about February 8, 2019. We are providing 
this notification to you as you were one of the individuals identified as having personal information contained within the 
account. Please note that, at this time, no one has reported to us that they have experienced loss, and to the best of our 
knowledge, no one has experienced any loss. 



What We Are Doing 


Voelker Entities are continuing to work closely with leading security experts to identify and implement measures 
to further strengthen the security of their systems to help prevent this from happening in the future. 

Out of an abundance of caution, we are offering you a free two-year membership to Equifax ID Patrol three- 
bureau credit monitoring service. This product helps detect possible misuse of your personal information and provides 
you with identity protection services focused on immediate identification and resolution of identity theft. This product 
also includes various features such as up to $1,000,000 in identity theft insurance with no deductible, subject to policy 
limitations and exclusions. Equifax ID Patrol is completely free to you and enrolling in this program will not hurt your 
credit score. For more information on identity theft protection and Equifax ID Patrol, including instructions on how to 
activate your complimentary two-year membership, please see the additional information attached to this letter. To take 
advantage of this offer , you must enroll by June 30, 2019. 

What You Can Do 

We remind you to remain vigilant for incidents of fraud or identity theft by reviewing account statements and 
credit reports for unauthorized activity. Residents of the United States are entitled to one free credit report annually from 
each of the three major credit reporting agencies. To order your free credit reports, visit www.annualcreditreport.com or 
call toll-free (877) 322-8228. If you detect any suspicious activity on an account, you should promptly notify the financial 
institution or company with which the account is maintained. You should also promptly report any fraudulent activity or 
any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the 
Federal Trade Commission. 

You may want to consider placing a fraud alert on your credit report. There are two types of fraud alerts you can 
place on your credit report to put your creditors on notice that you may be a victim of fraud - an initial alert and an 
extended alert. You may ask that an initial alert be placed on your credit report if you suspect you have been, or are about 
to be, a victim of identity theft. A fraud alert does not impact your ability to get a loan or credit, but rather alerts a 
business that your personal information may have been compromised and requires the business to verify your identity 
before issuing you credit. Although this may cause some delay if you are applying for credit, it may protect against 
someone else obtaining credit in your name. An initial fraud alert stays on your credit report for at least 90 days. You 
may have an extended alert placed on your credit report if you have already been a victim of identity theft with the 
appropriate documentary proof. An extended fraud alert stays on your credit report for seven years. You can place a 
fraud alert on your credit report by contacting any of the three national credit reporting agencies. The agency that you 
contacted must notify the other two agencies. 

Additionally, you have the right to put a credit freeze, also known as a security freeze, on your credit file, free of 
charge, so that no new credit can be opened in your name without the use of a PIN number that is issued to you when you 
initiate a freeze. A security freeze is designed to prevent potential credit grantors from accessing your credit report 
without your consent. If you place a security freeze, potential creditors and other third parties will not be able to access 
your credit report unless you temporarily lift the freeze. Therefore, using a security freeze may delay your ability to 
obtain credit. There is no fee to place or lift a security freeze. However, unlike a fraud alert, you must separately place a 
security freeze on your credit file at each of the three national credit reporting agencies. 

Below are the toll-free numbers and addresses for the three largest credit reporting agencies: 

TransUnion 

P.O. Box 1000 
Chester, PA 19016 
1-800-916-8800 
www.transunion.com 


Equitax 

P.O. Box 105139 
Atlanta, GA 30374 
1-800-685-1111 
www. equifax .com 


Expenan 

P.O. Box 2002 
Allen, TX 75013 
1-888-397-3742 
www.experian.com 



Other Important Information 


Below is the toll-free number, address and website address for the Federal Trade Commission, which you may 
contact to obtain further information on how to protect yourself from identity theft and how to repair identity theft: 

Federal Trade Commission 
Consumer Response Center 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www. ftc. go v/idtheft 

For residents of Hawaii, Michigan, Missouri, Virginia, Vermont and North Carolina : It is recommended by state 
law that you remain vigilant for incidents of fraud and identity theft by reviewing credit card account statements and 
monitoring your credit report for unauthorized activity. 

For residents of Illinois, Iowa, Maryland, Missouri, North Carolina, Oregon and West Virginia : It is required by 
state law to inform you that you may obtain a copy of your credit report, free of charge, whether or not you suspect any 
unauthorized activity on your account. You may obtain a free copy of your credit report using the contact information 
listed above. 


For residents of Iowa: State law advises you to report any suspected identity theft to law enforcement or the 
Attorney General. 

For residents of Oregon : State laws advise you to report any suspected identity theft to law enforcement, 
including the Attorney General, and the Federal Trade Commission. 


For residents of Maryland, Rhode Island, Illinois and North Carolina : You can obtain information from the 
Maryland and North Carolina Offices of the Attorney General and the Federal Trade Commission about fraud alerts, 
security freezes, and steps you can take toward preventing identity theft. 


Maryland Attorney 
General 

Consumer Protection Div. 
200 St. Paul Place 
Baltimore, MD 21202 
1-888-743-0023 
www.oag.state.md.us 


North Carolina Attorney 
General 

Consumer Protection Div 
9001 Mail Service Center 
Raleigh, NC 27699-9001 
1-877-566-7226 
www.ncdoi.com 


Rhode Island Attorney 
General 

Consumer Protection Div. 
150 South Main Street 
Providence, RI02903 
(401) 274-4400 
www.riag.ri.gov 


Federal Trade Commission 

Consumer Response Center 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www.identityTheft.gov 


For residents of Massachusetts and Rhode Island : It is required by state law that you are informed of your right to 
obtain a police report if you are a victim of identity theft. 


For residents of Connecticut, Massachusetts, Rhode Island and West Virginia : You also have the right to place a 
security freeze on your credit report by contacting any of the credit bureaus listed above. 


For More Information 


Voelker Entities value your business and understands the importance of protecting your personal information, and 
deeply regrets any concern this may have caused to you. Should you have any questions, please do not hesitate to contact 
(877) 804-6672 between 9am and 9pm Eastern Monday through Friday. 



Edward F. Voelker, Jr., Esq. 

Principal , Voelker & Associates, P.C. and Three Rivers Settlement 
Services, Inc. 







EQUIFAX 


Enter your Activation Code: «account_no» 


Product Information 


Equifax® Credit Watch™ Gold with 3-in-l Credit Monitoring provides you with the following key features: 

• 3- Bureau credit file monitoring 1 and alerts of key changes to your Equifax®, Transunion®, and Experian® credit 
reports 

• One Equifax 3-Bureau credit report 

• Automatic Fraud Alerts 2 With a fraud alert, potential lenders are encouraged to take extra steps to verify your ID 
before extending credit 

• Wireless alerts (available online only) Data charges may apply. 

• Access to your Equifax® credit report 

• Up to $1 MM Identity Theft Insurance 3 

• Live agent Customer Service 7 days a week from 8 a.m. to 3 a.m. 


Enrollment Instructions 

To sign up online for online delivery go to www.myservices.equifax.com/tri 

1. Welcome Page: Enter the Activation Code provided above in the “Activation Code” box and click the “Submit” 
button. 

2. Register: Complete the form with your contact information (name, gender, home address, date of birth, Social Security 
Number and telephone number) and click the “Continue” button. 

3. Create Account: Complete the form with your email address, create a User Name and Password, review the Terms of 
Use and then check the box to accept and click the “Continue” button. 

4. Verify ID: The system will then ask you up to four security questions to verify your identity. Please answer the 
questions and click the “Submit Order” button. 

5. Order Confirmation: This page shows you your completed enrollment. Please click the “View My Product” button 
to access the product features. 


To sign up for US Mail delivery, dial 1-855-833-9162 for access to the Equifax Credit Watch Gold with 3-in-l 
Credit Monitoring automated enrollment process. Note that all credit reports and alerts will be sent to you via US 
Mail only. 

1. Activation Code: You will be asked to enter your Activation Code provided above. 

2. Customer Information: You will be asked to enter your home telephone number, home address, name, date of birth 
and Social Security Number. 

3. Permissible Purpose: You will be asked to provide Equifax with your permission to access your credit file and to 
monitor your file. Without your agreement, Equifax cannot process your enrollment. 

4. Order Confirmation: Equifax will provide a confirmation number with an explanation that you will receive your 
Fulfillment Kit via the US Mail (when Equifax is able to verify your identity) or a Customer Care letter with further 
instructions (if your identity can not be verified using the information provided). Please allow up to 10 business days to 
receive this information. 


1. Credit monitoring from Experian® and Transunion® will take several days to begin. 

2. The Automatic Fraud Alert feature is made available to consumers by Equifax Information Services LLC and fulfilled on its behalf by Equifax 
Consumer Services LLC. 

3. Identity theft insurance is underwritten by American Bankers Insurance Company of Florida or its affiliates. The description herein is a summary 
and intended for informational purposes only and does not include all terms, conditions and exclusions of the policies described. Please refer to the 
actual policies for terms, conditions and exclusions of coverage. Coverage may not be available in all jurisdictions. 

Equifax® is a registered trademark of Equifax Inc. ©2017 Equifax Inc., Atlanta, Georgia. All rights reserved. 



